Vulnerability-Lookup

CVE-2026-41692 (GCVE-0-2026-41692)

Vulnerability from cvelistv5 – Published: 2026-05-07 20:01 – Updated: 2026-05-11 18:04

Title

i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes

Summary

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-11 18:03 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/i18next/i18nextify/security/ad…	x_refsource_CONFIRM
https://github.com/i18next/i18nextify/commit/16f2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
i18next	i18nextify	Affected: < 4.0.8	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41692",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T18:03:40.834025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T18:04:43.650Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "i18nextify",
          "vendor": "i18next",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response \u2014 for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T20:01:59.272Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
        },
        {
          "name": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
        }
      ],
      "source": {
        "advisory": "GHSA-6457-mxpq-4fqq",
        "discovery": "UNKNOWN"
      },
      "title": "i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41692",
    "datePublished": "2026-05-07T20:01:59.272Z",
    "dateReserved": "2026-04-22T03:53:24.407Z",
    "dateUpdated": "2026-05-11T18:04:43.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41692",
      "date": "2026-09-18",
      "epss": "0.00144",
      "percentile": "0.04087"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "i18nextify",
                "vendor": "i18next",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.0.8"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:i18next:i18nextify:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75BE4A58-77DC-4A0B-B94D-B7AFACC8A8B9",
                    "versionEndExcluding": "4.0.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response \u2014 for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8."
          }
        ],
        "id": "CVE-2026-41692",
        "lastModified": "2026-06-17T10:47:00.830",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-41692",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T18:03:40.834025Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-07T21:16:29.717",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-11T20:26:29+00:00",
      "cve": "CVE-2026-41692",
      "id": "CVE-2026-41692",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41692.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41692",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-11T18:03:40.834025Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-11T18:03:45.806Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "i18nextify",
              "vendor": "i18next",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.0.8"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response \u2014 for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-07T20:01:59.272Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
            },
            {
              "name": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
            }
          ],
          "source": {
            "advisory": "GHSA-6457-mxpq-4fqq",
            "discovery": "UNKNOWN"
          },
          "title": "i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-41692",
        "datePublished": "2026-05-07T20:01:59.272Z",
        "dateReserved": "2026-04-22T03:53:24.407Z",
        "dateUpdated": "2026-05-11T18:04:43.650Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-41692

Vulnerability from fkie_nvd - Published: 2026-05-07 21:16 - Updated: 2026-06-17 10:47

Severity

4.7 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.7 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e	Patch
	security-advisories@github.com	https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq	Vendor Advisory

Impacted products

	Vendor	Product	Version
	i18next	i18nextify	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "i18nextify",
          "vendor": "i18next",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.8"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:i18next:i18nextify:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "75BE4A58-77DC-4A0B-B94D-B7AFACC8A8B9",
              "versionEndExcluding": "4.0.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response \u2014 for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8."
    }
  ],
  "id": "CVE-2026-41692",
  "lastModified": "2026-06-17T10:47:00.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41692",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-11T18:03:40.834025Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-07T21:16:29.717",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6457-MXPQ-4FQQ

Vulnerability from github – Published: 2026-04-22 17:42 – Updated: 2026-05-11 13:29

Summary

i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

Details

Summary

Versions of i18nextify prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (replaceInside handler around line 122) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute.

Impact

When an attacker can influence the content of a translation file or the translation-backend response — compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON — they can:

Set any href on an anchor to a javascript: URI, executing arbitrary JavaScript when the victim clicks the link.
Set any src on <iframe>, <object>, or <embed> to a data:text/html URI containing a full script payload that runs in the page's origin.
Use vbscript: on legacy IE installations or file: for local-resource navigation attacks.

This path is distinct from the general i18nextify design that intentionally renders HTML from translations — href/src schemes are narrow and attack-specific, and no legitimate translation needs javascript: or data:. The fix therefore blocks these schemes outright without changing other behaviour.

Also fixed in 4.0.8

debug / saveMissing URL-parameter substring match. The previous detection window.location.search.indexOf('debug=true') > -1 matched the substring anywhere in the query string. A URL like ?nosaveMissing=true silently enabled saveMissing mode, causing the victim's browser to POST every unknown translation key to the configured addPath — a form of CSRF-style abuse of missing-key reporting. ?track_debug=true enabled verbose debug logging, leaking i18next internals to the console. Now uses URLSearchParams for exact parameter matching.
Optional sanitize(html, ctx) hook. The library's core purpose is to render HTML from translations — a behaviour that is safe only when the translation source is fully trusted. Applications with partially-trusted sources (user-contributed locales, third-party CDN, MITM-exposed HTTP backend) can now wire a sanitizer (e.g. DOMPurify) via i18next.options.sanitize. Defaults to pass-through to preserve existing behaviour for the main use case.

Affected versions

All versions of i18nextify prior to 4.0.8.

Patch

Fixed in 4.0.8. The URL-scheme blocklist is ^\s*(javascript|data|vbscript|file)\s*: (case-insensitive) applied to each translated value before it is joined back into the href/src attribute. Values matching the blocklist are replaced with an empty string so the attribute becomes harmless rather than leaving the attacker's URL in place.

Workarounds

No workaround short of upgrading. If you cannot upgrade immediately, audit every translation file for javascript:, data:, vbscript:, and file: prefixes in any value that may reach an href/src position, and restrict translation-file write access to trusted operators. Serving translations over HTTPS and pinning the translation backend to an internal origin reduce the MITM surface.

Credits

Discovered via an internal security audit of the i18next ecosystem.

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "i18nextify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41692"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-22T17:42:24Z",
    "nvd_published_at": "2026-05-07T21:16:29Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVersions of `i18nextify` prior to 4.0.8 substitute `{{key}}` interpolation tokens inside `src` and `href` attribute values with the raw string returned by `i18next.t()`. The substitution logic in `src/localize.js` (`replaceInside` handler around line 122) only guards against a duplicated `http://` origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as `javascript:alert(1)` or `data:text/html,\u003cscript\u003e...\u003c/script\u003e` is applied unchanged to the live DOM attribute.\n\n### Impact\n\nWhen an attacker can influence the content of a translation file or the translation-backend response \u2014 compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON \u2014 they can:\n\n- Set any `href` on an anchor to a `javascript:` URI, executing arbitrary JavaScript when the victim clicks the link.\n- Set any `src` on `\u003ciframe\u003e`, `\u003cobject\u003e`, or `\u003cembed\u003e` to a `data:text/html` URI containing a full script payload that runs in the page\u0027s origin.\n- Use `vbscript:` on legacy IE installations or `file:` for local-resource navigation attacks.\n\nThis path is distinct from the general i18nextify design that intentionally renders HTML from translations \u2014 href/src schemes are narrow and attack-specific, and no legitimate translation needs `javascript:` or `data:`. The fix therefore blocks these schemes outright without changing other behaviour.\n\n### Also fixed in 4.0.8\n\n- **`debug` / `saveMissing` URL-parameter substring match.** The previous detection `window.location.search.indexOf(\u0027debug=true\u0027) \u003e -1` matched the substring anywhere in the query string. A URL like `?nosaveMissing=true` silently enabled `saveMissing` mode, causing the victim\u0027s browser to POST every unknown translation key to the configured `addPath` \u2014 a form of CSRF-style abuse of missing-key reporting. `?track_debug=true` enabled verbose debug logging, leaking i18next internals to the console. Now uses `URLSearchParams` for exact parameter matching.\n- **Optional `sanitize(html, ctx)` hook.** The library\u0027s core purpose is to render HTML from translations \u2014 a behaviour that is safe only when the translation source is fully trusted. Applications with partially-trusted sources (user-contributed locales, third-party CDN, MITM-exposed HTTP backend) can now wire a sanitizer (e.g. DOMPurify) via `i18next.options.sanitize`. Defaults to pass-through to preserve existing behaviour for the main use case.\n\n### Affected versions\n\nAll versions of `i18nextify` prior to **4.0.8**.\n\n### Patch\n\nFixed in **4.0.8**. The URL-scheme blocklist is `^\\s*(javascript|data|vbscript|file)\\s*:` (case-insensitive) applied to each translated value before it is joined back into the `href`/`src` attribute. Values matching the blocklist are replaced with an empty string so the attribute becomes harmless rather than leaving the attacker\u0027s URL in place.\n\n### Workarounds\n\nNo workaround short of upgrading. If you cannot upgrade immediately, audit every translation file for `javascript:`, `data:`, `vbscript:`, and `file:` prefixes in any value that may reach an `href`/`src` position, and restrict translation-file write access to trusted operators. Serving translations over HTTPS and pinning the translation backend to an internal origin reduce the MITM surface.\n\n### Credits\n\nDiscovered via an internal security audit of the i18next ecosystem.",
  "id": "GHSA-6457-mxpq-4fqq",
  "modified": "2026-05-11T13:29:23Z",
  "published": "2026-04-22T17:42:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41692"
    },
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/i18next/i18nextify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-41692 (GCVE-0-2026-41692)

FKIE_CVE-2026-41692

GHSA-6457-MXPQ-4FQQ

Summary

Impact

Also fixed in 4.0.8

Affected versions

Patch

Workarounds

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour